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APOLLO EXPERIENCE REPORT 

COM/VIAND AND SERVICE MODULE 

ELECTRICAL POWER DISTRIBUTION SUBSYSTEM 

By Robert E. Munford and Bob Hendrix 
Lyndon B. Johnson Space Center 

SUMMARY 


The Apollo command and service module electrical power distribution subsystem 
was required to receive electrical power from any combination of seven direct-current 
sources (three fuel cells, three entry batteries, and one service module battery) and 
to condition, control, and deliver the power to the appropriate loads. To satisfy these 
requirements, the system was designed to perform the following functions. 

1. Distribute power to the various locations through a system of interconnecting 

cables 

2. Protect the wiring if a load malfunction occurred 

3. Prevent additional damage to the vehicle if a wire became overloaded 

4. Protect the various power sources from a malfunction in the loads or the 
wiring 

5. Protect each power source from a malfunction in any other power source 

6. Convert direct current to alternating current to satisfy load requirements 

Major developmental effort was expended on the static inverter, the most complex 
electrical unit in the system ; therefore, the history and design configurations of this 
device are discussed in detail in this report. Conversely, the motor-driven switch 
(which, electrically, is a relatively simple device) proved to be quite troublesome 
because of its complicated mechanical design and widespread use throughout the com- 
mand and service module. It is discussed in this report, and special emphasis is 
placed on problems that developed during the Apollo Program. The developmental 
efforts and problems with other allied equipment are also reviewed. 

Although numerous minor changes were made as a result of real or anticipated 
problems, the overall system performance was satisfactory throughout the program. 
Nevertheless, several recommendations worthy of consideration in the design of any 
new system are apparent from a review of the entire effort. Most of the recommenda- 
tions were made as a result of many incidents rather than a particular problem and 


are not specifically addressed in the text of the report, but are discussed more fully 
in the recommendations and concluding remarks. 

INTRODUCTION 


Throughout the active life of each Apollo vehicle, beginning with the initial power- 
up and continuing through checkout, flight, and postflight testing, the command and 
service module (CSM) electrical power distribution subsystem (EPDS) was used almost 
continually. Three fuel cells located in the service module (SM) provided the primary 
source of power for the major portion of a mission. The fuel cell output was supple- 
mented by two of the three 40-ampere-hour command module (CM) entry batteries 
during high-load phases of the mission and was backed up by a 400-ampere-hour 
battery in the SM (added after the flight of Apollo 13), which could be used if a fuel cell 
failed. The electrical configurations of the spacecraft during various phases of a 
normal mission are described in the following paragraphs. 

Near the end of the launch countdown period, the fuel cells were activated and 
remained active until CM/SM separation. A few minutes before lift-off, two entry 
batteries were connected to the main buses to provide power to the CM in the event of 
an abort. After the spacecraft was in orbit, the entry batteries were disconnected, 
recharged, and used only to supplement fuel cell power during service propulsion 
system (SPS) burns. Between burns, the load normally varied between 60 and 
80 amperes (well within the capability of the fuel cells) ; however, when gimbals 
were operated during SPS burns, the load could reach 120 amperes, requiring the 
additional capacity of the two entry batteries. 

All three entry batteries were switched to on-line status during preparation for 
entry and became, at CM/SM separation, the sole source of electrical power for the 
vehicle. During descent, the load was approximately 60 amperes and continued near 
that level until the vehicle was 800 feet above water and the main buses were deener- 
gized. After this time, only the recovery aids and various small loads on the post- 
landing bus required electrical power. 

DESIGN CONSIDERATIONS 


The EPDS of the Apollo CSM was designed to control, condition, and deliver , 

nominal 28 V dc and 115 V ac power. These tasks had to be accomplished with maximum i 

reliability, flexibility, and safety yet remain within weight and volume constraints. To 
satisfy these goals, the system was designed around two main buses in the direct- 
current system and two buses in the alternating-current system. ^ 

The direct-current system (fig. 1) accepted power from three fuel cells and 
three entry batteries and distributed this power to two main direct-current buses. J 

Loads on the buses were divided into the following three categories according to 
criticality and power source. 

I 

1. Nonredundant essential loads were fed from both buses through isolation diodes. | 

2. Redundant essential loads were arranged so that loads were fed from different 
buses. 
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Figure 1. - Structure of direct-current buses. 


3. Nonredundant nonessential loads were connected to the buses, as required, 
to equalize the loading on each bus. 

In addition to the inherent reliability provided by this mechanical configuration, 
mission success was further ensured by rigid quality control and careful inspection by 
qualified inspectors during all phases of equipment fabrication. Each function was 
checked several times after the system was installed in the vehicle. During flight, 
the crew monitored the essential parameters by display and control read-outs, and 
ground controllers monitored telemetered data. 

Typical production samples of each component or assembly were selected at 
random, subjected to qualification tests, and reevaluated. These tests, designed to 
simulate as nearly as possible the rigors of mission environments (plus an appropriate 
safety factor), were performed on each component or assembly. Results were then 
evaluated to determine the suitability of the equipment for flight. In addition, each 
component or assembly was subjected to acceptance testing. 

The EPDS was designed to increase reliability with maximum flexibility. Controls 
in the alternating- current system were provided to allow any inverter to be placed on 
either or both alternating- current buses; however, an interlock was provided to prevent 
connecting the inverter outputs in parallel. Similarly, any or all of the six normal 
direct- current sources (three entry batteries and three fuel cells) could be connected to 
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either or both main buses. Although the pyrotechnics were not a part of the EPDS, 
provisions were made for using main entry battery power to fire the explosive devices 
if the pyrotechnic batteries failed. 

Together with the normal precautions taken in any electrical installation to pro- 
tect the user from shock and the hardware from physical damage, the primary con- 
cerns in the design of the EPDS were for mission safety and for the protection of the 
power sources from downstream faults and fault propagation if problems did arise. ) 

Diodes, circuit breakers, fuses, and reverse and overcurrent sensors were used to | 

protect power sources. j 

Nonflammable, flame- retardant, and fire-resistant materials were used wherever 
possible. Both electrical and mechanical means were used to prevent the propagation 
of a fire. This was accomplished by coating the unprotected area behind the panels 
and exposed hardware with flame-retardant coatings, by using potting components, 
and by sealing enclosures. To prevent heat damage to adjacent wires if an overload 
occurred, each wire was selected to be compatible with its associated circuit breaker. 

Electrical cables were also routed through covered trays or behind closeout panels 
to protect them from physical damage. 

Because components of the EPDS were distributed throughout the CSM, the ) 

system was exposed to a variety of environments including water, urine, salt, and 
dust. Atmospheric pressure varied from sea level to the vacuum of deep space, and 
temperatures varied widely. In addition, equipment in the CM pressure vessel had 
to be capable of maintaining mechanical integrity when exposed to a 78g impact shock 
if touchdown occurred on land. Verification that the equipment could withstand these 
environments was determined by qualification testing. 

All the precautions mentioned previously were considered during the design, 
fabrication, and testing of the system to ensure crew safety and mission success. To 
improve the performance of the system further, the EPDS design was continuously 
reviewed, and each change or proposed change was evaluated in terms of reliability. 

The performance of the system during test and flight was reviewed to determine if any 
problems existed that might require design changes. 

A formal, computer-aided program was devised to identify "sneak circuits. " 

This program provided for the identification of current paths that were hot readily 
apparent from a review of the electrical schematics but might cause undesirable 
results. Some of these evaluations resulted in procedural changes, component replace- 
ment, and system modifications. 


SYSTEM DESCRIPTION 
Direct-Current Distribution 

The basic design of the direct-current distribution system (fig. 1) consisted of 
two buses (main bus A/SM bus A and main bus B/SM bus B) that were isolated from 
each other and energized by three fuel cells or three entry batteries. Redundant loads 
were connected to separate buses. Nonredundant critical loads were fed from both 
buses through diodes or double-throw switches to provide circuit isolation. Nonredun- 
dant noncritical loads were tied to either bus, as required, to equalize bus loading. 
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Entry batteries A and B supplied power to individual battery buses (battery 
buses A and B) that supplied logic and switching power to various controls. A third 
battery (entry battery C) supplemented A and B on the main buses during entry and after 
landing. Both battery buses supplied power to the battery relay bus, which distributed 
power to essential control functions. 

Three fuel cells in the SM provided the bulk of the power for a normal mission. 
Any fuel cell could be connected to either or both of the main buses, but the normal 
configurations were with fuel cells 1 and 2 on main bus A and with fuel cell 3 on main 
bus B. After a cryogenic supply failure, which resulted in the loss of all three fuel 
cells on Apollo 13, an auxiliary battery was added in the SM to supplement the 
remaining power sources if one or more fuel cells failed. 

A battery charger was provided to recharge the entry batteries from fuel cell 
power. The charger used both alternating current and direct current to apply a 
current-limited charge to one battery at a time. After being used, each battery was 
recharged as soon as practical to provide maximum power for entry or any contingency. 

As time passed, the need for added flexibility of power sources became apparent, 
resulting in the addition of circuit breaker (CB) 15 and CB24 (fig. 2) to make it possible 



Figure 2. - Battery circuits. 
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to put any battery on any bus in the power system. In addition, CB18 and CB19 were 
added to permit activation of a pyrotechnic bus by an entry battery if a need occurred. 
Although many other minor changes were made in both design and procedures, the 
system and system components remained basically the same as those flown in 1966 on 
spacecraft 009, the first Block I vehicle launched from the NASA John F. Kennedy 
Space Center. The more significant of these changes are reviewed in the following 
discussion. 

As mentioned previously, the power distribution system was designed around a 
network of buses, each with loads and sources peculiar to the criticality of the appli- 
cation. The direct-current bus structure consisted of nine interconnected buses. 
Although the SM buses provided power to some SM loads, they were extensions of the 
main buses and served primarily to route power from the fuel cells to the CM. 

The large circuit breakers on the output of the entry batteries were directly 
attached to the battery-mounting hardware to protect the wires leading to the first 
control panel. Overload and reverse-current sensors for each fuel cell (fig. 3) served 
a similar purpose in the SM. 



Figure 3. - Fuel cell control circuit. 
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A timing circuit (fig. 4) in the reac- Note: 


tion control system (RCS) provided automat- 
ic switching to connect the entry batteries 
to the main buses in the event of a pad 
abort. This feature allowed battery power 
to be conserved by operating the vehicle 
from ground power until just before lift- 
off. If an abort was necessary, crew ac- 
tion was not required to provide power to 
the CM after separation from the SM. 

Grounding 

To minimize electromagnetic inter- 
ference (EMI) from structural current, a 
single-point ground was used for the direct- 
current return, alternating- current 
neutral, pyrotechnic-initiating circuit re- 
turns, and shield grounds. This design is 
shown in figure 5 with all grounds returning 
to the vehicle ground point (VGP). When 
the CM was docked with the lunar module 
(LM) , all current flowing from the CSM to 
the LM was returned to the VGP through 
the CM/LM umbilical, thereby maintaining 
the single-point groimd configuration. 
Individual buses were provided to separate 
the power and signal grounds from the LM 
and CM until the grounds were tied to the 
VGP. 


K13 - AUTO RCS transfer 



Figure 4. - Entry battery/main bus 
tie control. 


LM negative 



Figure 5. - Vehicle ground point. 
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Alternating-Current Distribution 

Three-phase 400-hertz alternating 
current was delivered through two four-wire 
buses that could be energized by one or two 
of the three static inverters (fig. 6) . Each 
inverter had sufficient capacity to supply 
all alternating- current power required by 
the vehicle. This could be accomplished 
by paralleling both alternating- current 
buses to a single inverter, or each bus 
could be energized by individual inverters; 
however, the inverters could not be paral- 
leled without causing damage to the 
inverters. 

Circuits were provided in the 
alternating- current power control box that 
prevented parallel operation of the inverter 
outputs if improper procedures were 
followed. However, this switching system 
had defects involving a race between motor 
switches that could cause the loss of all 
alternating current to the spacecraft. This 
problem was overcome by rewiring the 
control switches on a priority system so 
that no switch race was possible. 



loads 


Figure 6. - Alternating-current power 
distribution. 


During Block I checkout, it was discovered that a portion of the guidance and 
navigation (G&N) information was derived from a phase shift between two signals, each 
of which originated from a different alternating- current bus. For the information 
to be valid, each bus had to be in phase with the other. Consequently, a phase- 
synchronization box was designed for Block I manned spacecraft. The G&N system was 
modified for Block II to eliminate the need for buses to be in phase. Because phase 
synchronization was no longer a requirement, the phase -synchronization box was 
deleted from Block II spacecraft. 


Sensors 

Sensors monitored the main direct-current buses for low voltage (fig. 7) and 
signaled the caution and warning (C&W) system if the voltage level fell below 26. 25 volts. 
Alternating-current buses were monitored by sensors (fig. 8) for low voltage, overload, 
and overvoltage. If either the load or voltage went out of limits, a C&W signal was 
initiated; however, of the three anomalous conditions, only an overvoltage condition 
required corrective action to be taken faster than a crewmember could react to the 
situation. Therefore, an overvoltage condition resulted in automatic disconnection of 
the faulty inverter. 
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Voltmeter 
main bus A 



Figure 7. - Direct- current undervoltage -sensing circuit. 



Audio tone and 
master alarm 


Figure 8. - Alternating- current sensing circuit: 
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Originally, the alternating- current sensing circuitry was designed to automat- 
ically disconnect an overloaded bus; however, because silicone-controlled rectifiers 
(SCR) in the inverter overload sensor circuit proved to be overly sensitive to current 
surges, several unnecessary losses of alternating- current power occurred. As a 
result, the disconnect feature of the sensor was disconnected, but the C&W alarm was 
retained. Mission success was not impacted because a crewman was always present in 
the CM to take the action required for an overload-bus condition. 


Control Units 

The greatest concentration of control functions in any single unit was in the SM 
power distribution box. This box, located on the upper deck of the SM, contained both 
automatic and remotely actuated motor switches to control direct current in the SM. 
Fuel cell outputs could be connected to either CM bus by motor switches that provided 
reverse current and overload protection. Provisions also were included for switching 
ground support equipment power to the vehicle and for protecting the buses if a heater 
short occurred in the environmental control subsystem. 

The CM direct-current power control box used motor-driven switches and stud- 
mounted diodes to switch power output from the CM batteries to the main buses. To 
achieve maximum heat transfer, the diodes were movinted directly on plated heat 
sinks; the plating was the only electrical insulation between the diode mounting base 
and the heat sink. Early in the test program, several failures occurred when the 
insulation was damaged and the diode shorted to ground. This problem was overcome 
by using plated washers between the diode and the heat sink; as a result, at least two 
failures in the plating were required before a short would occur. 

The battery charger (fig. 9) also was modified after fabrication because the 
output was originally calibrated for a particular current and wire routing. However, 
subsequent reconfiguration of the wiring and the addition of circuit breakers resulted 
in a buildup of tolerances which, when combined, caused the charger output to be 
inadequate. The unit had to be partly depotted to gain access to the potentiometer that 
controlled the output voltage level. Setting the potentiometer control at the proper 
level solved the problem. 

A major change was made in the configuration of the direct-current distribution 
system after the Apollo 13 mission. To enhance the probability of a safe return if all 
three fuel cells were lost, a 400-ampere-hour auxiliary battery was added in the SM. 
Two control boxes were added to the SM to provide switching and protection for the 
additional battery. 


10 




Figure 9. - Functional diagram of battery charger. 


1 nverter 

During the initial phases of the Apollo Program (1962 and 1963), studies were 
performed to determine the most feasible power system for motor applications. 

Because of these studies, a central inverter system was selected instead of individual 
inverters for each application. This system was chosen because it had the lowest 
weight and greatest reliability. Inverters were designed with an output capability of 
1250 volt-amperes, making it possible for a single unit to supply all the alternating 
current required by the vehicle (fig. 10) . Three such inverters were needed on each 
vehicle to meet the reliability requirements for mission success and crew safety. 

After the essential requirements were established, the inverter was designed to meet 
the following criteria. 

1. Phases: three-phase, 120° ±2° displacement 

2. Voltage: 115 ± 2 V ac (three-phase average), steady state 

3. Frequency: 400 hertz with 6400 hertz external timing; 400 ± 7 hertz when 
free running 

The original inverters, designated as the -0001 model, were modified several 
times after the flight of spacecraft 009 in early 1966. Each time a major modification 
was made in the design of the inverter, the model was designated by a new dash number 
to control usage. One such modification, which resulted in the -0004 model, was made 
because alternating-current modulation adversely affected the performance of the 
S-band transponder. 
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warning 



Figure 10. - Inverter block diagram. 


The inverter housing was redesigned for Block n spacecraft inverters to facilitate 
easy removal for repair purposes. At the same time, output connectors were installed 
in place of the terminals that were used on earlier models. Another change to the 
inverter was made after the Apollo 204 fire. The inverter housing was sealed to pre- 
vent propagation of fire if any component within the inverter ignited. This inverter 
became the -0008 model. 

The -0008 model was installed on the first series of Block n spacecraft and 
performed satisfactorily; however, the manufacturer of the power-switching transistors 
used in the inverters experienced difficulties in meeting delivery schedules. Conse- 
quently, a second source was selected to supply transistors with similar characteristics. 
The transistors from the second source had a slightly faster switching speed than the 
original ones; therefore, minor circuit modifications had to be incorporated, resulting 
in the -0010 inverter configuration. The -0010 model was first flown on the Apollo 10 
mission and performance was normal. Although the design was not altered after this 
configuration, thermal-acceptance testing of all black boxes became mandatory later 
in the Apollo Program. As a result, the -0008 and -0010 units became, after testing, 
the -0012 and -0014 units, respectively. 

During factory checkout of Apollo 12 hardware, occasionally the inverters tripped 
early during overload testing, thus failing to meet specification limits. The cause of 
these anomalies was determined to be electromagnetic interference, which was caused 
partly by the faster switching of the new transistors. A reassessment of mission 
constraints and failure modes indicated that only a remote possibility existed of a 
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failure being caused by a fast timeout or premature tripping of the inverter. This 
condition was tolerable; therefore, no further changes were made. 


Power Factor Correction Box 


Most of the alternating current generated was used to power fuel cell pump 
motors; consequently, the load was highly inductive. To compensate for the undesirable 
power factor resulting from this load, a capacitor bank was added to the motor circuits 
(fig. 11). These capacitors, together with protective fuses, were installed in the 
power factor correction box, which was originally located in the CM. The box was 
not changed for the Block II configuration, but the fuel cell pump motors were rede- 
signed. Because the new pump motors had a much better power factor than the old 
motors, it was found that, when the correction unit was used, the power factor was 
overcompensated and effectively nullified all gains from the correction unit. To rectify 
this problem without impacting schedules, some of the capacitance was removed by 
altering the panel wiring rather than by redesigning the box. This modification was 
made on early Block II vehicles. 



box. 


vehicle; therefore, a problem with any one 
design reliability. 


At a subsequent design review, it was 
determined that the correction unit contained 
a single failure point because current from 
both buses was routed through a single 
connector. At approximately the same 
time, an effort was underway to remove 
weight from the CM to lessen the load on 
the parachutes during entry. Because the 
power factor correction box functioned 
only when the fuel cell pump motors were 
in use, there was no requirement for the 
unit after the SM was jettisoned. Conse- 
quently, after the box was redesigned to 
eliminate the single failure point and to 
optimize the power factor, it was installed 
in the SM. 


COMPONENTS 
Motor Switches 

The most complex piece of mechanical 
gear in the electrical power system was the 
motor-driven switch (fig. 12) . Thirty- 
eight of these switches, in various configu- 
rations, were installed in each Block n 
switch created a potential impact on total 
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Figure 12. - Motor switch assembly. 


A more serious problem became 
apparent after the Apollo 14 mission. As a 
result of an investigation, a new failure mode 
of the motor switch was discovered. A 
switch in the direct-current power control 
box failed in midtravel. When the switch 
was opened for inspection, it was found that 
the motor armature had undergone exces- 
sive heating and the armature windings had opened. Additional investigation and 
disassembly of the motor showed that the commutator bars were separated from the 
rotor and presented evidence of extreme heat in the area of the brush/commutator 
interface. Furthermore, the buildup of residue on the commutator was far greater 
than normal. 


Although some motor -switch problems 
occurred during flight, the majority of the 
problems resulted from ground tests and 
operation. The motor switches proved to 
be extremely sensitive to mishandling, 
improper operation, or incorrect control 
circuitry. Most of the failures resulted 
from the application of a low control voltage 
or the simultaneous application of "on" and 
"off" commands. Both misapplications 
resulted in excessive buildup of heat and 
subsequent destruction of the motor. These 
problems were overcome, in part, by 
using special test consoles to test any equip- 
ment that contained motor switches and by 
providing strict procedures for operating 
the motor switches. 

During the first flight of a Block n 
vehicle, a problem appeared in a motor 
switch while it was removing three-phase 
power from fan motors. It was determined 
that the switch, which normally was back- 
filled with an inert gas and sealed with an 
environmental seal (metal to epoxy), had 
leaked to an altitude favorable to arcing. 

As a result, when the switch interrupted 
the highly inductive load, arcing occurred 
in the switch and sufficient EMI was created 
to trip the alternating- current sensor. The 
problem was overcome procedurally in real 
time; nevertheless, motor switches that are 
not hermetically sealed (metal to metal or 
glass to metal only) are no longer considered 
suitable for alternating- current circuits in 
vacuum applications. 
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During a thorough investigation, many switches were tested and then disassembled 
to facilitate a microscopic examination of the mechanism. No abnormal conditions were 
found in the gear train or other mechanical parts of the switch, and, in all anomalies of 
this type, it was determined that the motor was at fault. Small silicone grommets, used 
as seals in the motor housing, were not cured under uniform conditions; those not cured 
completely tended to revert to their precured condition. This reversion process was 
present at all temperatures; however, heat aggravated the condition. As the reversion 
progressed, the catalyst that was used for curing the silicone was released and migrated 
to the motor commutator where it combined with bearing oil and brush residue to form 
a high-resistance deposit between the brushes and commutator. This deposit resulted 
in excessive heat being generated at the interface, a low armature current, and, 
consequently, low motor torque. Loss of torque caused the motor to stall until the heat 
generated within the motor was sufficient to cause a wire in the armature to open. 

Motor-current traces, which depict the time required for the switch to transfer, 
and the amplitude of the current were taken before each operable switch was disas- 
sembled. These traces were compared with similar traces taken by the vendor during 
the fabrication of the switches. As a result of numerous trace evaluations, the transfer 
time, which proved to be a reliable indicator of the condition of a motor commutator, 
was used to identify switches with potential motor problems. The evaluation also estab- 
lished a maximum time in which a switch with a clean commutator should transfer; conse- 
quently, current traces were made for all switches in several phases of the checkout to 
determine the transfer time of each. Any switch with excessive transfer time was 
replaced. 

Another anomaly was discovered during the evaluation of current traces. Two 
switches did not begin transferring current until 50 to 100 milliseconds after power was 
applied. This condition was caused by a sticking brake on the motor. The brakes stuck 
because of cold flow of the brake lining after long periods of inactivity. After the 
switches were operated once in the vehicle checkout, they no longer had a tendency to 
stick, and that particular failure mode was of no further concern. 


Circuit Breakers 

Several difficulties were experienced during the qualification testing of circuit 
breakers. Most of the difficulties were caused by faulty test equipment and unrealistic 
performance requirements rather than the breaker design. When the tests were begun, 
the breakers consistently failed to pass the operational life test because of actuator knob 
breakage. Reappraisal of the actual breaker use, however, indicated that the require- 
ments were unrealistically severe. The breaker requirements were reviewed and then 
redefined to establish realistic requirements, after which the breakers performed 
satisfactorily. 

After a salt-spray test, a group of breakers was set aside for several hours 
before being checked functionally. When the test was attempted, salt had built up be- 
tween the actuator collar and the mounting sleeve to such an extent that the actuator 
could not be moved. This requirement was also determined to be unrealistic because 
it was not representative of actual conditions. Therefore, the breaker was not consid- 
ered to be unsatisfactory. 
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Trip limits for the breakers were selected without access to performance data. 
When tests were performed, many breakers failed to meet specified values. A review 
of trip limit values indicated that the specified limits were unrealistic and that breaker 
performance was satisfactory imder the redefined limit values, 

A problem peculiar only to large breakers developed when wires were attached to 
the terminals. When the bolts were tightened to specified torque values, the seal 
between the breaker body and the terminal lugs was cracked. Although this crack did 
not affect the strength of the breaker body, it violated the environmental seal. A room- 
temperature-vulcanizing (RTV) silicone compound was applied to the area to reseal 
the breaker. 

BeCctuse the three-phase circuit breakers were large and heavy, they were 
mounted by screws rather than by stem mounting. This condition resulted in excessive 
excursions of the internal mechanism during vibration testing. The excursions, in 
turn, caused the breakers to trip when the unit was vibrated. The problem was solved 
by adding metal pads to the front of the case to provide a more solid mounting. 

The direct- current breakers contained two cams in a mechanism for holding the 
actuator in the closed position that could, under selected conditions, cause erroneous 
performance. If only one cam dropped in place when the breaker was reset, it would 
appear to be in its normal closed configuration but would no longer operate within 
normal vibration limits. This potential problem was overcome procedurally, however, 
by cautioning the crewmen to press firmly on the actuator knob when closing a breaker. 

During the Apollo 14 mission, a breaker failed to make contact when it was 
mechanically closed. Postflight analysis disclosed a contaminant between the breaker 
contacts. The contaminant was lost before it could be analyzed; however, the substance 
on the contacts was probably bits of glass from a small fiberglass board inside the 
breaker. Because this was the only known instance of this problem, corrective action 
was not considered necessary. 


Relays 

Block I vehicles included an essential alternating- current bus that was automati- 
cally switched to the alternate source if low voltage was experienced. Switching was 
accomplished by using relays that were qualified for single-phase operation. However, 
three-phase alternating current was being switched, which resulted in arcing between 
the contacts and destruction of the relays. The possibility of the aforementioned 
condition was not considered during the original parts selection; as a result, a relay 
capable of switching three-phase power was selected. 

Relays were used in a cryogenic control box that was added to the vehicle during 
the modification resulting from the Apollo 13 inflight problems. The original control 
box was designed to have motor switches because they had no contact bounce, had high 
current and voltage ratings, and were immune to vibration; however, as previously 
noted, the motor switches were unsuitable for switching alternating current in a 
vacuum. Consequently, when the additional box was designed, relays were used for all 
switching functions. 
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PI jacket: Premolded polyimide glass jacket. Consists of three layers, each of 
which is 8-mil glass cloth impregnated with polyimide resin and molded 
to a snug fit. Minimum thickness = 0.025 in.; used in the CM crew 
compartment as a fire retardant 


SAFETY MEASURES 


A major consideration in the design of 
the EPDS was the prevention of fault propa- 
gation. Loads were placed on individual 
circuits and isolated by circuit breakers, 
fuses, or overload sensors. Buses were 
isolated with diodes and reverse-current 
sensors. Maximum physical protection 
was provided for boxes, components, and 
wires to prevent damage during manufac- 
ture, checkout, and flight. Closeout panels 
and cable covers were used to shield the 
equipment. Conformal coating was used 
behind the panels and in other inaccessible 
areas. A typical example of the coating 
applied to exposed electrical connections 
is shown in figure 13. The coating not only 
protected the* system from shorts caused 
by floating debris but also sealed the com- 
ponent against moisture and provided an 
inhibitor to prevent flame propagation. 


Wires, were especially vulnerable to 
damage from overheating of adjacent 
wires because most of the wiring in the 
vehicle is bound tightly in bundles. To 
assess the reliability of the wiring and to 
establish proper ground rules for harness 
design, extensive testing was performed. 
Wires were exposed to a variety of temperatures and pressures, some typical of those 
that were anticipated and others in excess of what the wires were expected to undergo. 
Tests also were performed to establish the pertinent characteristics of the insulation 
at different temperatures. Data from these tests were used to establish time limits 
for various combinations of ambient temperature and pressure for single wires and for 
those in bundles. 


RTV 560-577 blend : Room-temperature-vulcanizing silicone rubber; used for 
electrical insulation, moisture, and physical protection around the wire 
and circuit breaker terminal 

Ladicote: A fire-retardant material for protection against burning in pure 
oxygen atmospheres. 

Figure 13. - Component coating. 


Trip characteristics of each type circuit breaker were determined at various 
altitudes and pressures in a series of tests that established the derating necessary for 
operation in mission environments. The breakers also were subjected to several 
different combinations of ambient conditions, during which the trip times were recorded 
for different degrees of overload. Results from these tests then were used to establish 
wire-size/circuit-breaker compatibility criteria. Design was kept within these limits 
to ensure the integrity of adjacent wires if an overload condition occurred. 
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RECOMMENDATIONS AND CONCLUDING REMARKS 


The final overall design of the Apollo electrical power distribution system was 
adequate. All the original concepts, however, were not satisfactory, as can be seen 
in retrospect. Examples of some of the designs that were either modified or discontin- 
ued are the automatic main bus disconnect, the automatic alternating- current overload 
disconnect, and the inverter switching arrangement. 

Based on a review of experiences described in this report, several recommenda- 
tions are listed that might be beneficial to new programs. 

1. All equipment should be designed, fabricated, located, and mounted for easy 
removal, repair, and replacement. 

2. Inverters or other alternating-current Sources should be in phase and should 
have the capability of being paralleled. 

3. Motor switches, if used, should be hermetically sealed (metal to metal or 
metal to glass), and the effects of long-term exposure to environments normally 
considered inert should be investigated thoroughly. 

4. Solid-state power controllers should be considered in any application for which 
remote switching is required. 

5. All stud-mounted diodes used for power-source isolation should be anode 
mounted. If a diode mounted in this manner shorts to ground, only one power source 
will be affected. 

6. An active program for identifying and correcting single failure points and 
"sneak circuits" should begin early in the design and continue until the end of the 
program. 

Additional recommendations, not obvious from this report but based on an 
evaluation of the final design of the command and service module electrical power 
system and its overall performance throughout the Apollo Program, are also listed. 

1. Arc-suppression diodes should be the fail-open type. 

2. Diodes used in steering functions should be the fail-short type. 

3. Some type of laboratory device (e.g. , breadboard, test jig, functional mock- 
up, or prototype) should be available for evaluation of the electrical power distribution 
subsystem design early in the program and for use in providing real-time support 
during missions. Several circumstances arose during flight in which a dedicated device 
for electrical power distribution subsystem simulation would have been helpful in 
recreating problems and evaluating workarounds. The device, regardless of nomen- 
clature, should be primarily for electrical power distribution subsystem support with 
quick-change capabilities to keep the configuration current. 
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A realistic qualification program with rigid quality controls is necessary in the 
selection of effective equipment. Comprehensive testing of each component and of 
higher assemblies is required. The experience gained from the performance of the 
Apollo electrical power distribution subsystem should be used in the formulation of 
guidelines for the design of electrical power systems for future space vehicles. 


Lyndon B. Johnson Space Center 

National Aeronautics and Space Administration 
Houston, Texas, December 10, 1973 
914-11-00-00-72 
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